2026 SourceNext — member-info API abuse; up to 22,519,960 records
Data compromised
Company maximum: 22,519,960 member records. Possible fields (not every member had every field): email, password, name/kana, address, sex, phone, fax, DOB, company/title/dept, service identifiers (join/login dates). Credit-card data not stored on the hit system. Company forced password resets.
Technical writeup
Verified SourceNext notices 15 Oct 2026. Access 9 Oct ~10:00 JST via member-info API; found 13 Oct ~09:00; contained 13:36. PPC report 15 Oct; police filing planned 16 Oct. recordsAffected 22519960 is the company ceiling. companyConfirmed true.
Root cause
Unauthorized use of the member-information retrieval API from ~10:00 JST 9 Oct through detection ~09:00 13 Oct; containment by 13:36 the same day. Root cause of API abuse still under investigation.